Double free error in libmad - CVE-2018-7263

Vulnerability identifier: #VU11227

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-7263

CWE-ID: CWE-415

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the mad_decoder_run() function due to double free error. A remote attacker can submit a specially crafted file and cause the service to crash.

libmad
SDL (Red Hat package)
orc (Red Hat package)
gstreamer1-plugins-bad-free (Red Hat package)
gstreamer1-plugins-base (Red Hat package)
gstreamer1-plugins-good (Red Hat package)
gstreamer1-plugins-ugly-free (Red Hat package)
gstreamer1 (Red Hat package)
SDL2 (Red Hat package)
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64

Cybersecurity is currently unaware of any solutions addressing the vulnerability.

SDL (Red Hat package) - update to 1.2.15-37.el8
orc (Red Hat package) - update to 0.4.28-3.el8
gstreamer1-plugins-bad-free (Red Hat package) - update to 1.16.1-1.el8
gstreamer1-plugins-base (Red Hat package) - update to 1.16.1-1.el8
gstreamer1-plugins-good (Red Hat package) - update to 1.16.1-1.el8
gstreamer1-plugins-ugly-free (Red Hat package) - update to 1.16.1-1.el8
gstreamer1 (Red Hat package) - update to 1.16.1-2.el8
SDL2 (Red Hat package) - update to 2.0.10-2.el8

• https://bugzilla.redhat.com/show_bug.cgi?id=1477498

• Denial of service in Underbit libmad
• RHSA-2020:1631 - Security Advisory